The present invention relates generally to the field of computer security. In general, a computing device may have one or more vulnerabilities that can be leveraged by malicious code to compromise the computing device. In addition, malicious code might be introduced onto a computing device by deceiving the user. Computer security is improved through the detection of malicious software (“malware”) that uses malicious code to exploit vulnerabilities or deceives the user in order to repurpose infected computers. Once malware is detected, the deceptive behavior is identified, and/or the exploits are understood, security systems may be designed to recognize and block the malware and the vulnerabilities may be patched.